I am trying to automate the installation of certificate(s):q! in jboss server. i wrote this rudimentary script:


set Temp_Dir "/tmp/install"
set jboss_sec "/opt/jboss/security"
set jboss_prof "/opt/jboss/profiles/CLOUD_0000"
set fokp [open "/tmp/install/keystore.pw" r]
#set frkp [read $fokp]
set frkp [read -nonewline $fokp]

exp_internal 1
spawn sudo keytool -import -keystore /opt/jboss/security/server_keystore.jks -file /tmp/install/mqcert/'Symantec_Class_3_Secure_Server_CA_-_G4.cer' -alias Symantec
expect { "Enter keystore password" { send "$frkp\r" }}
expect { "Owner" { send "yes\r" } eof }

#spawn sudo keytool -import -keystore $jboss_sec/server_keystore.jks -file $Temp_Dir/mqcert/TRMISMQtestSwifNetCertauth.cer -alias TRMISMQtestSwifNetCertauth
#expect { "Enter keystore password\r" { send "$frkp\r"  }}
#expect { "Trust this certificate?\r" { send "yes\r" } eof }


cloud-user@jboss-vm1-98ojcp:~ $ ./Step3-tcl-script.sh
spawn sudo keytool -import -keystore /opt/jboss/security/server_keystore.jks -file /tmp/install/mqcert/'Symantec_Class_3_Secure_Server_CA_-_G4.cer' -alias Symantec
Enter keystore password:  spawn sudo keytool -import -keystore /opt/jboss/security/server_keystore.jks -file /tmp/install/mqcert/TRMISMQtestSwifNetCertauth.cer -alias TRMISMQtestSwifNetCertauth
Enter keystore password:  (DEV) cloud-user@jboss-vm1-98ojcp:~ $

And the cerfitcates are not installing because its not going for second expect where it is asking for "Trust this certificate?"

If i run the command manually

cloud-user@jboss-vm1-98ojcp:/tmp/install/mqcert $ sudo keytool -import -keystore /opt/jboss/security/server_keystore.jks -file Symantec_Class_3_Secure_Server_CA_-_G4.cer  -alias Symantec
Enter keystore password:
Owner: CN=Symantec Class 3 Secure Server CA - G4, OU= Trust Network, O= Corporation, C=US
Issuer: CN= Public Primary Certification Authority - G5, OU="(c) 2006  - For authorized use only", OU=Trust Network, C=US
Serial number: 513fb9743870b734404
Valid from: Wed Oct 30 20:00:00 EDT 2013 until: Mon Oct 30 19:59:59 EDT 2023
Certificate fingerprints:
         MD5:  23:D5:85:F7:26:C5
         SHA1: FF:E1:8B:CC:E1:D7:0F:DA:BD:7C:86:61:35
         SHA256: EA::98:D0:F0:D6:A9:CF:17
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3


#1: ObjectId: Criticality=false
AuthorityInfoAccess [
   accessMethod: ocsp
   accessLocation: URIName: http://s2.symcb.com

#2: ObjectId: Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 7F D3 65 A7  F3 43 39 FA 02  ..e......0..C9..
0010: AF 33 31 33                                        .313

#3: ObjectId: Criticality=true

#4: ObjectId: Criticality=false
CRLDistributionPoints [
     [URIName: http://s.crl]

#5: ObjectId: Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [2.16.840.1.113733.1.7.54]
[PolicyQualifierInfo: [
  qualifier: 0000:    2F 77 77 77 2E 73 79 6D  ..http://www.sym
0010: 61 75 74 68 2E 63 6F 6D   2F 63 70 73              auth.com/cps

], PolicyQualifierInfo: [
  qualifier: 0000: 303  0...http://www.s
0010: 79 6D 61 75 74 68 2E 63   6F 6D 2F 72 70 61        ymauth.com/rpa

]]  ]

#6: ObjectId: Criticality=true
KeyUsage [

#7: ObjectId: Criticality=false
SubjectAlternativeName [

#8: ObjectId: Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
00: 5F 60 CF 61 90 55 DF 84   60 2A B2 F5 7A  _`.a.U..C..`*..z
00: F4 4 EF                                        .C..

Trust this certificate? [no]:  no
Certificate was not added to keystore

The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore /opt/jboss/security/server_keystore.jks -destkeystore /opt/jboss/security/server_keystore.jks -deststoretype pkcs12".

Am i doing any mistake in anywhere?


cloud-user@jboss-vm1-98ojcp:~ $ ./Step3-tcl-script.sh
spawn sudo keytool -import -keystore /opt/jboss/security/server_keystore.jks -file /tmp/install/mqcert/'Symantec_Class_3_Secure_Server_CA_-_G4.cer' -alias Symantec
parent: waiting for sync byte
parent: telling child to go ahead
parent: now unsynchronized from child
spawn: returns {8220}

expect: does "" (spawn_id exp5) match glob pattern " "Enter keystore password\r" { send "$frkp\r" }"? no
Enter keystore password:
expect: does "Enter keystore password:  " (spawn_id exp5) match glob pattern " "Enter keystore password\r" { send "$frkp\r" }"? no
expect: timed out

expect: does "Enter keystore password:  " (spawn_id exp5) match glob pattern " "Owner" { send "yes\r" } eof "? no
expect: timed out
  • after applying the debug command and fix the frkp variable.
    – ZHA
    Jan 22, 2019 at 18:54
  • Do you see the "expect: timed out" lines? Check the line above to see that the incoming text does not match your pattern (due to the \r in the pattern text). Jan 22, 2019 at 19:35

2 Answers 2


Don't use \r in the expected pattern to match, since it stands for carriage-return and the prompts you are getting do not seem to end with one. For example, replace "Owner\r" by "Owner". Only use \r to end a reply you are sending, such as "yes\r".


set frkp [read $fokp] -- this will include the trailing newline from the file, and you probably don't want to include that character as part of the passphrase. Instead:

set frkp [read -nonewline $fokp]

Also, while developing your expect script, add the command exp_internal 1 before the first spawn. The verbose debugging output will show you why your patterns aren't matching.

  • debug info added.
    – ZHA
    Jan 22, 2019 at 18:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .